CVE-2026-105785

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings.

Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation.

Joplin Server prior to 3.7.7 contains a stored XSS vulnerability in the GET /shares/:id?resource_id= route, which serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens.

Joplin Server prior to 3.7.2 contains a vulnerability in UserModel.ssoLogin() that returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password.

Joplin Server before version 3.7.7 with TRANSCRIBE_ENABLED=true has a vulnerability in the GET/POST /api/transcribe/:id routes where the decoded id is passed directly to transcription backend URLs. An authenticated user can use URL-encoded slash and parent-directory segments to escape the intended /transcribe/ prefix and proxy requests to other internal endpoints, potentially exposing administrative, health, or configuration data. This issue is fixed in version 3.7.7.

Joplin Server before version 3.7.2 has a vulnerability in the GET /items/:id/content route that loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.